Security Vulnerabilities
CVE-2026-76461
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
Known exploited
CVSS Score
9.8
EPSS Score
0.022
Published
2026-09-14
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.1.3 is able to resolve this issue. The patch is identified as 700137738bcaebefd4709021f6d6b0abcd7df0ac. It is recommended to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score
2.1
EPSS Score
0.002
Published
2026-09-13
Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with any user ID to obtain the owner's credential hash for offline cracking, enabling account takeover of the highest-privileged account.
CVSS Score
6.0
EPSS Score
0.002
Published
2026-09-12
Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credential is resolved by raw Credential.id via getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace, unlike other credential read paths which are workspace-scoped. As a result, an authenticated low-privilege user (or workspace API key) in one workspace can supply a credential ID owned by another workspace and cause Flowise to act as a confused deputy, performing third-party provider calls with the victim workspace's credential and returning provider metadata to the attacker. Statically identified affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret itself is not returned to the attacker. This issue is fixed in version 3.1.4.
CVSS Score
6.1
EPSS Score
0.002
Published
2026-09-12
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.
CVSS Score
6.3
EPSS Score
0.002
Published
2026-09-12
CVE-2026-85706
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
Known exploited
CVSS Score
10.0
EPSS Score
0.111
Published
2026-09-12
The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL
and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers. An
application that obtains these finders through
RegexNameFinderFactory.getDefaultRegexNameFinders(...) and then applies them to
untrusted text through RegexNameFinder.find(String[]) or RegexNameFinder.find(String)
can be driven into super-linear backtracking or into unbounded matcher recursion by a
small crafted input.
For the EMAIL pattern, a long run of local-part characters that is never followed by an
@ forces the matcher to re-scan to end-of-input from every starting offset. Cost grows
quadratically with input length: an input of approximately 32 KB consumes several seconds
of CPU in a single find() call and returns no match, and each doubling of the input
multiplies the cost roughly four-fold.
For the URL pattern, the query-string sub-expression nests a capturing repetition inside
an outer repetition. The JDK matcher recurses once per query token, so an input of
approximately 4 KB containing many &-separated tokens exhausts the thread stack and
causes java.lang.StackOverflowError to propagate out of find(), terminating the
calling thread. On a thread created with a smaller stack (for example -Xss512k, typical
of server worker pools) approximately 1 KB is sufficient.
In both cases an attacker who can supply text for analysis can convert a single request
into seconds to minutes of pinned CPU, or into an abrupt thread death, denying service to
the embedding application. No authentication, special configuration, or model file is
required beyond the application having selected one of the two built-in finders.
This issue affects Apache OpenNLP: from 2.0.0 through 2.5.11; from 3.0.0-M1 through
3.0.0-M5.
Users are recommended to upgrade to version 2.5.12, or to 3.0.0-M6 for users tracking the
3.0.0 milestone line, which fix the issue.
CVSS Score
10.0
EPSS Score
0.003
Published
2026-09-11
OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer
Versions Affected:
- 3.0.0-M4
- 3.0.0-M5
(The opennlp-spellcheck extension was introduced in 3.0.0-M4. Releases 1.x and 2.x do not contain the affected code.)
Description:
The SymSpellModelSerializer.create() method reads two 32-bit signed integer count fields (unigramCount and bigramCount) from a binary SymSpell model stream and passes each value directly to LinkedHashMap.newLinkedHashMap() after validating only that it is non-negative. No upper bound is applied, so the count is fully attacker-controlled when the model file originates from an untrusted source.
A crafted .bin model file in which either count field is set to Integer.MAX_VALUE (or any value large enough to exhaust the available heap) causes the map to be pre-sized to a capacity of 2^30 entries. The oversized backing array is allocated on the first put() into that map, requesting 4–8 GB depending on whether compressed oops are in effect, and the load fails with an OutOfMemoryError. Because the count fields sit immediately after a fixed-size header (magic, format version, three UTF strings, the configuration fields, and the edit-distance identifier) the attacker pays no meaningful size cost to weaponize a payload: a file of well under 100 bytes plus a single real entry is sufficient to crash a JVM that loads it.
Any code path that deserializes a SymSpell model is affected, including SymSpellModels.deserialize(InputStream), SymSpellModels.fromBytes(byte[]), classpath model loading via SymSpellModelResolver.resolveByLanguage(String), the CorrectTextTool command-line tool, and model-archive loading through the registered ArtifactSerializer. The opennlp-spellcheck extension ships in the official OpenNLP binary distribution.
The practical impact is denial of service against processes that load SymSpell model files from untrusted or semi-trusted origins.
Mitigation:
- 3.x users should upgrade to 3.0.0-M6.
Note: The fix applies an upper bound to both count fields, checked before the map is pre-sized; counts that are negative or exceed the bound cause an IOException to be thrown and the read to fail fast with no large allocation. The bound is the existing AbstractModelReader.MAX_ENTRIES limit introduced earlie, which the current change promotes to public visibility so that serializers implementing their own binary format can share it. The default bound is 10,000,000, which is well above the entry counts of legitimate SymSpell dictionaries but far below any value that would threaten heap exhaustion. Deployments that legitimately need to load larger dictionaries can raise the limit at JVM startup by setting the OPENNLP_MAX_ENTRIES system property to the desired positive integer (e.g. -DOPENNLP_MAX_ENTRIES=50000000); invalid or non-positive values fall back to the default. Note that this property is shared with the model-reader limit and raising it relaxes both.
Users who cannot upgrade immediately should treat all SymSpell .bin model files as untrusted input unless their provenance is verified, and should avoid loading models supplied by end users or fetched from third-party repositories without integrity checks.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-09-11
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value.
To remediate this issue, users should upgrade to version 4.3.0 or later.
CVSS Score
6.0
EPSS Score
0.003
Published
2026-09-11
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
CVSS Score
2.9
EPSS Score
0.001
Published
2026-09-11